Segmentation Fault Vulnerability in fig2dev Package: CVE-2025-46399
Summary
UBUNTU-CVE-2025-46399: Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function. Affects fig2dev versions 1:3.2.6a-3 – 1:3.2.6a-6ubuntu1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fig2dev package is a utility that converts figures from various formats into device-specific formats for output. It is widely used in graphical applications and supports multiple input formats. However, a critical vulnerability has been identified in versions of fig2dev, which could lead to a segmentation fault, potentially allowing attackers to manipulate local input and disrupt service availability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-46399, originates from a segmentation fault in the genge_itp_spline function within the fig2dev package version 3.2.9a. This flaw allows an attacker to exploit local input manipulation, leading to service disruption. The CVSS score for this vulnerability is 7.1, indicating a high severity level, particularly concerning the potential for denial of service attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the fig2dev tool with untrusted input until the package is updated. Additionally, consider implementing input validation to mitigate the risk of exploitation.
Conclusion
The segmentation fault vulnerability in the fig2dev package (CVE-2025-46399) poses a significant risk to users, allowing potential service disruptions through local input manipulation. It is crucial to update to the latest patched version of the package to mitigate this risk.
See every vulnerability recorded for fig2dev →
FAQ
CVE-2025-46399 is a vulnerability in the fig2dev package that can cause a segmentation fault, potentially allowing attackers to disrupt service availability through local input manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by CVE-2025-46399 without requiring any signup.
The CVSS score for this vulnerability is 7.1, indicating a high severity level that could lead to denial of service attacks.
To fix the vulnerability, update the fig2dev package to a patched version using the command: sudo apt update && sudo apt install fig2dev.
As a workaround, avoid using fig2dev with untrusted input and implement input validation to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for fig2dev.
